/*

* Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

#include <hash.h>

#include <bigint.h>

#include "pkcs12kdf.h"

EXPORT_C HBufC8* PKCS12KDF::GeneratePasswordLC(const TDesC& aDes)

/**

	Convert the supplied string to a byte string, as described

	in SB.1 of the PKCS 12 v1.0.

	Each character is converted to a big endian two-byte value,

	and a terminating NULL character is appended to the end.

	@param	aDes			String to use as password.

 */

	{

	const TInt len = aDes.Length();

	HBufC8* pwdBytes = HBufC8::NewMaxLC((len + 1) * 2);

	TPtr8 pbDes = pwdBytes->Des();

	TInt i = 0;

	while (i < len)

		{

		TUint16 ch = aDes[i];

		pbDes[i * 2] = ch >> 8;

		pbDes[(i * 2) + 1] = ch;

		++i;

		}

	pbDes[i * 2] = pbDes[(i * 2) + 1] = 0;

	return pwdBytes;

	}

static TInt CeilDiv(TInt aNumerator, TInt aDenominator)

/**

	Utility function returns ceil(aNumerator / aDenominator).

	@param	aNumerator		The numerator.

	@param	aDenominator	Denominator, which cannot be zero.

	@return					ceil(aNumerator / aDenominator)

 */

	{

	TInt result = aNumerator / aDenominator;

	if ((aNumerator % aDenominator) > 0)

		++result;

	return result;

	}

EXPORT_C void PKCS12KDF::DeriveKeyL(

	TDes8& aKey, TIDByteType aIDType,

	const TDesC8& aPasswd, const TDesC8& aSalt, const TUint aIterations)

/**

	Generate a key for the supplied password and salt.

	This implementation uses SHA1 as the hashing algorithm.

	@param	aKey			Descriptor which will hold key.  On entry

							its length must be set to the expected key length.

	@param	aIDType			Whether this function is being called to generate

							an (en|de)cryption key, an initialization vector,

							or a key for MAC-ing.  See SB.3 of spec.

	@param	aPasswd			Password string.  To comply with PKCS#12 spec,

							this must have 2-byte big-endian characters with

							a terminating null character.

	@param	aSalt			Used with aPasswd to generate key.

	@param	aIterations		Number of times to call the hash function for

							each block in the key.

	@panic	PKCS#12 16		Password is empty (debug only.)

	@panic	PKCS#12 17		Password does not contain an even number of bytes,

							and so can't use double-byte characters (debug only.)

	@panic	PKCS#12 18		The final two-byte character is not a null terminator,

							or a null terminator occurs before the end (debug only.)

 */

	{

	__ASSERT_DEBUG(aPasswd.Length() >= 2, Panic(EDKEmptyPswd));

	__ASSERT_DEBUG((aPasswd.Length() % 2) == 0, Panic(EDKOddPswdByteCount));

	TInt useCharCount = aPasswd.Length() / 2;

	TPtrC16 pswd16(reinterpret_cast<const TUint16*>(aPasswd.Ptr()), useCharCount);

	TInt nullPos = pswd16.Locate(L'\0');

	__ASSERT_DEBUG(nullPos == (useCharCount - 1), Panic(EDKBadNullTerminator));

	// use the same notation as the standard

	const TUint8 ID = static_cast<TUint8>(aIDType);

	const TInt u = 160;					// chaining variable length for SHA-1

	const TInt v = 512;					// message input length for SHA-1

	const TInt n = aKey.Length() * 8;	// number of bits required in key

	const TInt p = aPasswd.Length();

	const TInt s = aSalt.Length();

	const TInt r = aIterations;

	// (numbered steps are from the standard)

	// 1. Construct a string, D (the "diversifier"), by concatenating

	// v/8 copies of ID.

	const TInt D_LEN = v / 8;

	HBufC8* D_ = HBufC8::NewMaxLC(D_LEN);

	TPtr8 D = D_->Des();

	D.Fill(ID);

	// 2. Concatenate copies of the salt together to create a string S

	// of length v * ceil(s/v) bits (the final copy of the salt may be

	// truncated to create S).  Note that if the salt is the empty string,

	// then so is S.

	const TInt S_OVER_V_CEIL = CeilDiv(s, v);

	const TInt S_LEN = (v * S_OVER_V_CEIL) / 8;

	HBufC8* S_ = HBufC8::NewMaxLC(S_LEN);

	TPtr8 S = S_->Des();

	S.Repeat(aSalt);

	// 3. Concatenate copies of the password together to create a string P

	// of length v * ceil(p/v) bits (the final copy of the password may be

	// truncated to create P).  Note that if the password is the empty string

	// then so is P.

	const TInt P_OVER_V_CEIL = CeilDiv(p, v);

	const TInt P_LEN = (v * P_OVER_V_CEIL) / 8;

	HBufC8* P_ = HBufC8::NewMaxLC(P_LEN);

	TPtr8 P = P_->Des();

	P.Repeat(aPasswd);

	// 4. Set I=S||P to be the concatenation of S and P.

	const TInt I_LEN = S_LEN + P_LEN;

	HBufC8* I_ = HBufC8::NewLC(I_LEN);

	TPtr8 I = I_->Des();

	I.Copy(S);

	I.Append(P);

	// 5. Set c=ceil(n/u).

	const TInt c = CeilDiv(n, u);

	// ahead 7: allocate result buffer A

	// (Each Ai has SHA1_HASH bytes.)

	HBufC8* A_ = HBufC8::NewLC(c * SHA1_HASH);

	TPtr8 A = A_->Des();

	// 6. For i=1, 2, ..., c, do the following

	// pre-allocate SHA1 object, DI, and B buffers

	CSHA1* sha1 = CSHA1::NewL();

	CleanupStack::PushL(sha1);

	const TInt DI_LEN = D_LEN + I_LEN;

	HBufC8* DI_ = HBufC8::NewLC(DI_LEN);

	TPtr8 DI = DI_->Des();

	const TInt B_LEN = v / 8;

	HBufC8* B_ = HBufC8::NewMaxLC(B_LEN);

	TPtr8 B = B_->Des();

	for (TInt i = 1; i <= c; ++i)

		{

		// 6a) Set Ai = H^r(D||I).  (i.e. the rth hash of D||I,

		// H(H(H(...H(D||I))))

		DI.Copy(D);

		DI.Append(I);

		sha1->Reset();

		TBuf8<SHA1_HASH> Ai(sha1->Final(DI));

		for (TInt iterCount = 2; iterCount <= r; ++iterCount)

			{

			Ai.Copy(sha1->Final(Ai));

			}

		// 6b) Concatenate copies of Ai to create a string B of length

		// v bits (the final copy of Ai may be truncated to create B).

		B.Repeat(Ai);

		// 6c) Treating I as a concatenation I0, I1, ..., Ik-1 of

		// v-bit blocks, where k=ceil(s/v)+ceil(p/v), modify I by

		// setting Ij=(Ij+B+1) mod 2^v for each j.

		const TInt k = S_OVER_V_CEIL + P_OVER_V_CEIL;

		for (TInt j = 0; j < k; ++j)

			{

			TPtr8 section = I.MidTPtr((v/8) * j, v/8);

			Process6cL(section, B, v);

			}

		// 7. Concatenate A1, A2, ..., Ac together to form a pseudo-random

		// bit string, A.

		A.Append(Ai);

		// stop building A if already have enough bits for key

		if (A.Length() >= n / 8)

			break;

		}

	// Use the first n bits of A as the output of this entire process.

	aKey.Copy(A.Left(n / 8));

	CleanupStack::PopAndDestroy(8, D_);	// B_, DI_, sha1, A_, I_, P_, S_, D_

	}

void PKCS12KDF::Process6cL(TDes8& Ij, const TDesC8& B, TInt v)

/**

	Helper function for DeriveKeyL modifies part of I,

	as described in step 6c of SB.2.

	@param	Ij		Section of I (S || P).

	@param	B		rth hash of D || I.

	@param	v		Number of bits to preserve in result.

 */

	{

	// 6c) Treating I as a concatenation I0, I1, ..., Ik-1 of

	// v-bit blocks, where k=ceil(s/v)+ceil(p/v), modify I by

	// setting Ij=(Ij+B+1) mod 2^v for each j.

	RInteger RI_Ij = RInteger::NewL(Ij);

	TCleanupItem ciIj = RI_Ij;

	CleanupStack::PushL(ciIj);

	RInteger RI_B = RInteger::NewL(B);

	TCleanupItem ciB = RI_B;

	CleanupStack::PushL(ciB);

	// these additions can leave

	RI_Ij += RI_B;

	RI_Ij += 1;

	HBufC8* result = RI_Ij.BufferLC();

	Ij.Zero();

	TInt resultLen = result->Length();

	TInt bytesToPreserve = v / 8;

	TInt leadingZeroes = bytesToPreserve - resultLen;

	if (leadingZeroes <= 0)

		Ij.Copy(result->Right(bytesToPreserve));

	else

		{

		Ij.FillZ(leadingZeroes);

		Ij.Append(*result);

		}

	CleanupStack::PopAndDestroy(3, &RI_Ij);	// result, ciB, ciIj

	}

#ifdef _DEBUG

void PKCS12KDF::Panic(PKCS12KDF::TPanic aPanic)

/**

	This function is used in debug builds to halt

	the current thread when a logic error is detected.

	The current thread is panicked with category "PKCS12KDF"

	and the supplied reason.

	@param	aPanic			Converted to numeric value and

							used for the panic reason.

 */

	{

	_LIT(KPanicCat, "PKCS12KDF");

	User::Panic(KPanicCat, aPanic);

	}

#endif